Authentication Bypass Vulnerability in Apache DRPC
CVE-2026-124496

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Storm
Vendor: CVE Published:; 11 November 2026

What is CVE-2026-124496?

The Apache DRPC has a vulnerability that allows authenticated clients to impersonate other users without proper authorization checks. This flaw enables an authenticated user to execute restricted DRPC functions typically reserved for a different user, posing a significant security risk. Users are urged to update to version 3.2.0 to mitigate this issue.

Affected Version(s)

Apache Storm 3.0.0 < 3.2.0

References

https://lists.apache.org/thread/z8r5mxcpfgklq820j8krk8ozq...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 11, 2026
Vulnerability Reserved
Nov 8, 2026

Credit

Javier García Herrera

CVE-2026-124496 Data

JSON